HTML forms without your own backend: getting started with ZoraForms

When an action attribute is enough

Create a website and a form in the dashboard, then copy the form’s public address from the Integration tab. Place it in the action attribute of your existing form and set the method to POST. Every field that should appear in a submission needs a name attribute. This works well for a static site, a landing page, or a simple form embedded in a CMS.

Replace YOUR_PUBLIC_ID in the example with the identifier from your dashboard. Do not use the example address in production and do not put a secret in HTML. The public ID identifies the submission target; the service still checks form configuration, limits, and availability.

<form action="https://forms.example.com/f/YOUR_PUBLIC_ID" method="POST">
  <label>Email <input name="email" type="email" required /></label>
  <label>Message <textarea name="message" required></textarea></label>
  <button type="submit">Send</button>
</form>

Match the form to your site

Add the allowed origin that sends data in the form settings. An origin includes the protocol and host, such as https://example.com. The www version is a different host from the non-www version. This helps catch code deployed on the wrong site before it becomes a production issue.

Make one real submission after deployment and inspect it in Submissions. Field names appear in the details, so use names such as email, message, or company instead of opaque abbreviations. If you need a custom success message or an interface without a page reload, use the generated fetch version from the Integration tab.

• Add the website with its correct domain.
• Create the form and copy code for its current settings.
• Enter the origin of the page hosting the form.
• Send a test and verify it in the dashboard.

Protection and limits are more than action

Action alone is suitable only when CAPTCHA and a minimum completion time are disabled. If you enable CAPTCHA, a honeypot, or a time limit, download the complete current snippet from the dashboard. It includes the fields and tokens required by that configuration. CAPTCHA is optional per form and verified server-side; it helps reduce automated submissions but does not promise to remove all spam.

The Free plan lets you run one website and one form and accept up to 100 submissions each month. Before it can accept submissions, you must prove control of a public domain with a DNS TXT record. Paid plans do not require this proof. The dashboard shows current usage, so check it before a campaign with heavier traffic.

Once the form is connected, you can grow it without replacing a backend: enable optional CAPTCHA, add UTM attribution, or configure a webhook. Start with a working POST, then confirm each configuration change with a fresh integration snippet and a brief site test.